Perforce
Perforce (official product name: Helix Core) is an enterprise-grade version control and collaboration platform developed by Perforce Software. It uses a centralized architecture and is designed to manage very large-scale codebases and binary assets. Core features include high-performance file version tracking, fine-grained access control, and efficient handling of large binary files. It is widely used in software development, game development, hardware design, and other industries with high-concurrency and large-capacity version management requirements.
Timeline (last 90 days)
Systems such as Perforce and Sapling have made targeted optimizations for managing large-scale binary assets.
Perforce disclosed the CVE-2026-109758 vulnerability, which involves issues with default tokens and a PATCH path parser in its SCIM implementation.
Perforce's SCIM implementation allows authentication using the default bearer token publicly documented in the documentation and does not mandate changing it, so an attacker only needs to know the token value to call the SCIM API with administrator privileges.
Perforce's SCIM PATCH path parser fails to properly filter input, allowing attackers to construct malicious paths that break out of the intended attribute modification scope, and in some tests even allowing arbitrary code execution.
All Facts (4)
Systems such as Perforce and Sapling have made targeted optimizations for managing large-scale binary assets.
50%UnverifiedPerforce's SCIM implementation allows authentication using the default bearer token publicly documented in the documentation and does not mandate changing it, so an attacker only needs to know the token value to call the SCIM API with administrator privileges.
50%UnverifiedPerforce's SCIM PATCH path parser fails to properly filter input, allowing attackers to construct malicious paths that break out of the intended attribute modification scope, and in some tests even allowing arbitrary code execution.
50%UnverifiedPerforce disclosed the CVE-2026-109758 vulnerability, which involves issues with default tokens and a PATCH path parser in its SCIM implementation.
50%